Legal

Privacy Policy

Last updated: 28 October 2026 · Version 1.5

1. About this policy

This Privacy Policy explains how Digs collects, uses and shares personal data when you use our website, app, forms, communications or related online services. Digs is an online housing matching and introduction platform. Features may change as we develop the service. This policy applies to everyone who uses or interacts with Digs, including account holders, prospective users, property and business contacts, and people who communicate with us. Digs is for people aged 18 and over — please do not use Digs if you are under 18.

2. Who is responsible for your data

For the purposes of UK data protection law, AIVANCI LTD, trading as Digs, is the controller of the personal data described here, which means we decide how and why it is used. AIVANCI LTD is a company registered in England and Wales under company number 16823149, with registered office at Colony - Flint Glass Works, 64 Jersey Street, Manchester, England, M4 6JW. You can contact us about privacy matters at info@aivanci.com. AIVANCI LTD, trading as Digs, is registered with the Information Commissioner’s Office (ICO) as a data controller.

3. Personal data we collect

We collect the information needed to provide, manage, secure and improve Digs:

Account and contact details — such as your name, email address, phone number (if provided), city or area, your institution or organisation (if provided), and basic account and authentication information.
Service information you provide — your housing requirements, preferences and criteria, budget and timing information where relevant, request details, status, and any notes or free text you choose to add.
Request, activity and consent records — the requests and enquiries you submit, your consent choices, records of when and how consent was given or withdrawn, service communications, and activity connected to your use of the platform.
Optional profile information — if you use optional profile or housemate-introduction features, a short bio, photos or other media, household or lifestyle preferences, and, only if you choose to provide it and give separate explicit consent, your gender and any housemate gender preference. These features are optional; you can stop using them or ask us to remove this information.
Safety and moderation information — reports, blocks, misuse concerns, moderation decisions, account restrictions and related communications.
Property and business contacts — if you interact with Digs in a business or property capacity, your name, company or trading name, email, phone, city or area, and information you provide in connection with the service.
Technical and usage information — authentication and session data, device, browser and usage information, security logs, and low-identifiability analytics data. Our analytics are configured so that they do not intentionally include names, emails, phone numbers, photos, free-text notes, message content, precise addresses, gender identity or trans-status signals, or other directly identifying or sensitive user-submitted content.

Early-access registrations and the prize draw

When you join our early-access list, we require your email address and mobile number, and collect your chosen city, moving timeframe and whether you are a student, graduate or another house hunter. We also record the campaign or referral link you used and any optional housing preferences you provide. By joining, you request a text containing your Digs app invite. Separately, if you tick the optional email checkbox, you ask Digs to email your invite, housing updates and offers. The email choice starts unticked; declining it does not affect your SMS invitation or prize-draw entry. You can unsubscribe from emails at any time, and can cancel your SMS invitation request by contacting us. Joining does not sign you up for general marketing texts or WhatsApp messages. We record the wording version, time and source of your request and email choice. Earlier registrations retain the contact permissions described when they joined.

Eligible registrations also enter the prize draw under our Prize draw T&Cs. We use registration and referral records to check eligibility, count valid entries, select a winner and contact them. If you win, we may request proof of age, UK residence and rent due so we can verify eligibility and arrange the prize. Our lawful bases are performing the prize-draw agreement you enter and our legitimate interests in preventing fraud and evidencing a fair draw. Any separate marketing choice remains optional.

4. Information we do not ask for

Digs does not ask you to provide most special-category or highly sensitive personal data and does not need it to provide the core service. Please do not submit sensitive or protected-characteristic information, including details about race or ethnicity, religion or beliefs, sexuality, disability, physical or mental health, political opinions, trade union membership, genetic or biometric data, criminal records, nationality or immigration status, or identity, visa or financial documents through your housing profile. If you win the prize draw, we may separately request the limited verification information described above.

If you include this type of information despite this warning, we may delete, redact, restrict or securely handle it where necessary to operate the service, protect users, comply with law, handle complaints, or establish, exercise or defend legal claims. Preferences and practical information you submit must not be used for unlawful discrimination.

Optional gender for housemate matching. Separately, if gender matching is ever enabled, you may choose to tell us your gender to help us suggest compatible housemates. Gender-related answers are optional, can be skipped, require separate explicit consent, are never shown to landlords or agents, and are never used to match you to properties. Gender matching and LGBTQ+ household signals are disabled unless separately approved and enabled with the safeguards described here. We treat gender self-describe, non-binary and similar information as potentially special-category data where it could reveal gender identity or trans status, and we apply explicit-consent, access-control, no-hard-exclusion and no-analytics safeguards. You can withdraw consent at any time, after which we stop using the gender signal and remove it from active matching fields where technically feasible while keeping necessary consent/audit records.

5. How we use personal data

We use personal data to create and manage accounts; provide and operate Digs; understand and process your requests; identify relevant options within the service; manage communications and optional features; record consent choices; keep the service safe; moderate content and handle reports; prevent misuse; send service messages; improve the product; maintain service records; comply with legal obligations; and handle complaints, disputes and privacy-rights requests. We do not sell your personal data.

6. Matching and recommendations

We may use your profile and preferences to identify relevant housing options for you before any of your contact details are shared with a landlord or agent. Your identifying details are shared externally only when you give consent for a specific enquiry (see section 8).

If you use our optional housemate-introduction features and choose to provide a gender and a housemate gender preference, we may use them, with your separate explicit consent, only as a soft housemate-compatibility signal within those features. We do not use gender as a hard exclusion filter, do not use it to match you to properties, do not include it in match reasons or analytics, and never share it with landlords or agents. You can withdraw this consent at any time, after which we stop using your gender for matching and remove it from active matching fields where technically feasible.

7. Our lawful bases

We use personal data only where we have a lawful basis under UK data protection law. In summary:

Creating and managing your account — contract, or steps before entering a contract.
Providing, operating, securing and improving Digs, processing your requests, identifying relevant options, preventing misuse, and content moderation and reports — contract and/or legitimate interests.
Sharing your contact details with an external contact for a specific request, optional profile/introduction features, and marketing emails — consent (unless another lawful basis clearly applies to a specific case).
Legal compliance — legal obligation.
Complaints, disputes and legal claims — legitimate interests or legal obligation.
Optional public-page analytics and advertising measurement — consent. Other product analytics remain subject to cookie/storage consent where required.

Our legitimate interests include operating, securing and improving Digs, processing requests, preventing misuse, maintaining records, and supporting safe use of the platform. You can object to processing based on legitimate interests, or withdraw consent, at any time by contacting info@aivanci.com.

8. When we share personal data

Sharing for a specific request. Where a request requires us to share your contact details with an external contact (such as a landlord or agent), we do this only where you have consented to that specific request, or where another lawful basis clearly applies. You can withdraw consent at any time; withdrawal does not undo sharing that has already happened, but we will stop further sharing where we can.

Service providers. We use providers to help us operate, secure and improve Digs — including hosting, database and file storage, authentication, email delivery, analytics, AI-assisted support, and security and operational tools. They may process personal data for us only as needed to provide their services.

Referral provider. ViralTree (viraltree.io) provides the referral links and sharing tools on our early-access page. It processes signup and referral information, including your email address, campaign context, referral activity and browser identifiers, to recognise your registration, provide your personal sharing link and credit referrals. This provider processing does not give landlords or agents access to your details.

Authorised staff review. Authorised Digs staff may review profiles, photos, notes, matches, proposed introductions, consent records and moderation/safety information where needed to operate the service, support users, review matches, handle reports, prevent misuse and comply with legal obligations.

Legal, safety and professional purposes. We may share information with professional advisers, insurers, regulators, law enforcement, courts or other parties where necessary for legal, safety, regulatory or dispute-related purposes.

Business changes. If Digs is sold, merged, reorganised or transferred, personal data may be transferred as part of that process, subject to appropriate protections.

9. AI-assisted support

Digs may use AI-assisted tools to help organise information, support service operations and prepare draft content or summaries. AI-assisted output may be incomplete or inaccurate. We do not make decisions about users that produce legal or similarly significant effects based solely on automated processing. Where AI processing of personal data requires extra consent or processor review, those features stay off or use a deterministic non-AI fallback until cleared.

10. Cookies and similar technologies

Your choices. Public Digs pages offer separate choices for Analytics (Google) and Advertising (Meta). Choose Accept all or Reject all, or open Manage cookies to select the purposes you want and Save choices. Both optional purposes start off unless you previously accepted that purpose. Use Cookie settings in the footer of public pages to change or withdraw your choices. We store your choices for up to 180 days. Rejecting either purpose does not affect signing up or using Digs. We do not load these tags on signed-in, authentication, invitation, shared-home or partner-token pages.

Analytics (Google). With your permission, Google Analytics 4 measures public-page visits and successful early-access signups. Google receives technical information such as your IP address, browser/device information, analytics identifiers, public-page path and referring website origin. Our code removes query parameters and fragments from the page URL sent to Google and sends no form answers or contact fields with the signup event. Google may store analytics cookies for up to 180 days. See Google’s privacy policy.

Advertising (Meta). With your separate permission, the Meta Pixel sends public-page visits (PageView) and confirmed early-access signups (Lead) to Meta to measure advertising and help us show Digs ads to previous visitors on Facebook and Instagram. Meta receives browser/device information, IP address, page and referrer URLs, and browser or advertising identifiers, including Meta cookies and supported campaign/click identifiers. Meta may match this activity to your Meta account. We skip the Pixel on URLs or referrers containing private paths, referral tokens or unrecognised parameters. We do not supply email addresses, mobile numbers, housing answers or signup tokens to the Pixel, and automatic advanced matching is disabled in our integration. Meta controls its own cookie lifetimes and data handling; see Meta’s privacy policy and cookie policy. Withdrawing advertising consent stops this Pixel on Digs and removes its accessible first-party cookies; it does not erase information Meta already received. You can also use Meta’s privacy and advertising controls.

We use technologies that are strictly necessary for authentication, security and operating the service. We may also use analytics technologies to understand how Digs is used and improve it. Where cookies, local storage or similar technologies are not strictly necessary, we use them only where we have the required consent or where they are configured so that consent is not required.

On the early-access page, ViralTree uses browser storage to recognise referral links and restore your sharing tools. Digs also stores a limited confirmation that you joined the list so the success screen can return when you reopen the page; that confirmation does not contain your email address or private preference-edit token. You can clear this information in your browser settings.

11. Marketing

We may send service messages about your account, requests, security, consent choices and important updates. We will only send marketing emails where we have a valid lawful basis; we use a separate marketing opt-in where consent is required. You can unsubscribe from marketing at any time.

12. International transfers

Some of our service providers may process personal data outside the UK. Where this happens, we use appropriate safeguards required by data protection law — such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or other approved safeguards.

13. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes in this policy. We use the following retention schedule unless a legal, safety, dispute or audit reason requires a different period:

Early-access registrations: kept while we manage your registration, invitation and any optional email subscription; after you unsubscribe or request deletion, removed or anonymised within 90 days where technically feasible, except records still needed to administer the draw, evidence consent or meet legal obligations.
Prize draw records: kept for up to 2 years after the draw closes, or longer where required for a dispute or legal obligation.
Account, profile and intake data: kept while your account is active, then deleted or anonymised within 90 days of an account-closure or deletion request where technically feasible.
Match/admin notes: reviewed and deleted or anonymised after 12 months unless needed for safety, dispute, legal or audit reasons.
Photos/uploads: deleted when you remove them or your account is deleted; otherwise kept while your profile is active.
Consent and legal acceptance records: kept for up to 6 years to evidence consent and terms/privacy acceptance history.
Support and privacy-rights requests: kept for up to 6 years for audit, dispute handling and legal compliance.
Raw operational/error logs containing personal data: kept for up to 180 days.
Pseudonymous product analytics: kept for up to 24 months for product development, safety, reliability and funnel improvement.
Aggregated or effectively anonymised analytics: kept indefinitely.

Analytics must exclude sensitive profile fields, free-text notes, gender identity/trans-status signals, photos, message contents, precise addresses and special-category data unless separately approved. If you delete your account, directly linked analytics identifiers should be deleted or irreversibly anonymised where technically feasible.

14. Security

We use technical and organisational measures designed to protect personal data, including encryption in transit, access and authentication controls, private storage where appropriate, limited internal access, security logging, supplier due diligence, and moderation and misuse controls. No online service is completely secure, but we work to reduce risk and respond appropriately to security issues.

15. Your rights

Under UK data protection law you may have the right to access your personal data; correct inaccurate data; ask us to delete it; restrict or object to certain uses; receive certain data in a portable format; and withdraw consent. To make a request, contact info@aivanci.com. We may need to verify your identity, and we normally respond within one month unless the law allows longer.

16. Complaints

If you have a privacy concern, please contact us at info@aivanci.com. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator.

17. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to let users know. The latest version will always be available at /privacy.